Personnal Data Protection Policy

Purpose of this policy

The purpose of this document is to inform of Lycée Français de Singapour policies on data collection, usage, disclosure, processing and protection, which are subject to the Singapore Personal Data Protection Act 2012 (“PDPA”) and to General Data Protection Regulation (UE) 2016/679 (GDPR).

Lycée Français de Singapour firmly undertakes to respect a set of rules of good conduct and of regulations in order to guarantee respect for the confidentiality of all personal data:

Data Collected

Lycée Français de Singapour is collecting the following data

The personal data is entered through forms and through the interactivity established between the user and Parents' Portal. Lycée Français de Singapour also use cookies and/or logs to collect information about Parents' Portal usage.

Forms and interactivity

Personal data is collected through forms, namely:

Application registration form

School registration, re-enrolment, deregistration forms

Other personalised forms

Log files and cookies

Lycée Français de Singapour collects certain information through log files and cookies. This mainly concerns the following information: IP address at registration, pages visited in Parents' Portal and requests, connection time and day. The use of such files allows Lycée Français de Singapour to improve and personalise the service and to establish anonymous statistics.

Purpose of personal data collection

Lycée Français de Singapour is collecting personal data for the following purposes (list below not exhaustive):

External uses: AEFE's website and social media, School’s website and social media, documents presenting the School etc…

Consent

Parental Consent

For
the purpose of school students in grades up to and including “Terminale”,
parental consent is sufficient.

Lycée Français de Singapour will
collect
and use personal data in
accordance with Personal Data Protection Act (2012) and GDPR. Consent to the
School using
such data as set out above can be given in the Student
Contract, Legal Authorisation
Form and Parents' Portal.

Management and Care of Personal Data

Protection of Personal Data

Lycée Français de Singapour undertakes to:

Implement appropriate security measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular when the processing of data involves the transmission or storage on or within a network. Lycée Français de Singapour uses the following technical measures:

Access to platform via secure connection (HTTPS) on a DMZ network,

Only authorized personnel are able to access the data,

Network monitoring, intrusion detection and virus defense software,

Encrypted computer backups that can only be restored on the original platform,

Connection to Parents' Portal is protected by a login / password combination,

The server hosting the plaform is protected by a hardware firewall and a software firewall.

Notify data subjects about any accidental or unauthorised access of their data that may lead to damage or harm.

Right of Access, Correction and restriction

Partents have a right to see the personal data (subject to the exemptions listed below) and to request for data to be corrected if it is incorrect. Parents will be provided access to data held about their children whilst they are students at the School within the limitations of this policy.

Thanks to Parents’ Portal, parents have unlimited access to their data. Correction or withdrawal is possible at any time if needed.

The Legal Authorisation Form is submitted to parents on a yearly basis via Parents’ Portal. It is always possible to change the answers provided to this form.

Exemptions to Right of Access

Lycée Français de Singapour retains the right to refuse access to:

Opinion data kept for evaluative purposes

Examination papers or the results of examinations

Confidential references written to support a student's application to other educational institutions or courses

Data or material that would provide personal data about other individuals in contravention of this policy or of the law.

Right to restriction of processing

Under certain circumstances, GDPR provides the right for Parents to obtain from Lycée Français de Singapour restriction of processing of the Data. To exercise this right, please contact the Lycée Français de Singapour Data Protection Officer: dpo@lfs.edu.sg

Right to Portability

Thanks to Parents’ Portal, Parents can receive the personal data in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller.

To exercise this right, please log into Parents' Portal, go to "Account settings" and click on "download my personal data". The system creates an encrypted compressed file protected with a password.

Data Retention & Removal

Lycée Français de Singapour shall take reasonable effort to destroy or anonymise documents containing Personal Data as soon as it is reasonable to assume that:

The purpose for which the Data was collected is no longer being served by retention of the Data; and

Retention is no longer necessary for legal or business purposes.

Right to be forgotten

Pursuant to GDPR, Parents will have the right to obtain erasure of the personal data under certain circumstances. To exercise this right, please contact the Lycée Français de Singapour Data Protection Officer: dpo@lfs.edu.sg

Sharing Data with Third Parties

Personal Data may be disclosed by Lycée Français de Singapour to its third party service providers or agents in Singapore (such as travel agents, insurance companies and data hosting companies) for one or more of the Purposes. Personal Data may also be disclosed to some schools outside of Singapore or to the French Ministry of Education, the AEFE or any other institution under its responsibility which may be located outside of Singapore, for one or more of the Purposes.

Lycée Français de Singapour will only share data for the purposes of eliciting a necessary service from these third party organisations and not for commercial gain.

Lycée Français de Singapour signs contracts to ensure that the organisation is using the data purely for the intended purpose of providing the required service and that it is taking appropriate precautions to safeguard the data. In some instances, for example for online services, explicit signed contracts do not exist.

In these instances the School will ensure that the terms & conditions of the service include clauses that:

Lycée Français de Singapour remains the owner of the data,

The service provider is not entitled to use any data held on its service for any purpose other than to provide the required service,

The service provider is taking reasonable precautions to ensure the security of the data,

Once the School terminates its agreement with the service provider, that any and all data held will be deleted and not used for any other purpose,

The service provider is compliant with PDPA and GDPR.

In the event of any queries or complaints in relation to data protection, please contact our Data Protection Officer: dpo@lfs.edu.sg